Jump to content

Importing E01 files


KGoins

Recommended Posts

I can't find this in any of the documentation I have for SE. Can E01 files be imported? I have FTK Imager Lite and can mount them if necessary, but I wanted to make sure I wasn't spinning my wheels if it won't work.

Link to comment
Share on other sites

I can't find this in any of the documentation I have for SE. Can E01 files be imported? I have FTK Imager Lite and can mount them if necessary, but I wanted to make sure I wasn't spinning my wheels if it won't work.

Link to comment
Share on other sites

  • IPRO Employee

Hello,

 

I have tested Ingesting Natives from a mounted forensic image (using FTX Imager) successfully using the 64-bit Streaming Engine. I would highly recommend either selecting the Native File Option "Copy files to case directory" or extracting the files from the mounted forensic image and then ingesting from that location. Reason being is if you do not then any ingested natives will reference the mounted forensic image path which will be invalid to all machines except the one it is mounted on.

 

Thank you,

 

Michael Delgado

Technical Support Engineer II

Link to comment
Share on other sites

  • IPRO Employee

Hello,

 

I have tested Ingesting Natives from a mounted forensic image (using FTX Imager) successfully using the 64-bit Streaming Engine. I would highly recommend either selecting the Native File Option "Copy files to case directory" or extracting the files from the mounted forensic image and then ingesting from that location. Reason being is if you do not then any ingested natives will reference the mounted forensic image path which will be invalid to all machines except the one it is mounted on.

 

Thank you,

 

Michael Delgado

Technical Support Engineer II

Link to comment
Share on other sites

  • 4 weeks later...

Thank you, Michael. I eventually decided to mount the E01s and then bring the documents in through the Native Ingestion function just as you suggested. I was hoping there was a way to do it without mounting the E01s.

Link to comment
Share on other sites

Thank you, Michael. I eventually decided to mount the E01s and then bring the documents in through the Native Ingestion function just as you suggested. I was hoping there was a way to do it without mounting the E01s.

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...